Update dependency gradio to v4.19.2 [SECURITY] #29
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
changed the title
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/pypi-gradio-vulnerability
branch
from
d3dbac5
to
579fc89
Compare
|
Cannot update because of gradio-app/gradio#7549 |
renovate
bot
force-pushed
the
renovate/pypi-gradio-vulnerability
branch
from
579fc89
to
9cf9da4
Compare
renovate
bot
force-pushed
the
renovate/pypi-gradio-vulnerability
branch
from
9cf9da4
to
724ac94
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==4.19.0->==4.19.2GitHub Vulnerability Alerts
CVE-2024-1729
Impact
This security policy is with regards to a timing attack that allows users of Gradio apps to potentially guess the password of password-protected Gradio apps. This relies on the fact that string comparisons in Python terminate early, as soon as there is a string mismatch. Because Gradio apps are, by default, not rate-limited, a user could brute-force millions of guesses to figure out the correct username and password.
Patches
Yes, the problem has been patched in Gradio version 4.19.2 or higher. We have no knowledge of this exploit being used against users of Gradio applications, but we encourage all users to upgrade to Gradio 4.19.2 or higher.
Fixed in: gradio-app/gradio@e329f1f
CVE-2024-1727
A Cross-Site Request Forgery gives attackers the ability to upload many large files to a victim, if they are running Gradio locally. To resolve this a PR tightening the CORS rules around Gradio applications has been submitted. In particular, it checks to see if the host header is localhost (or one of its aliases) and if so, it requires the origin header (if present) to be localhost (or one of its aliases) as well.
CVE-2024-1728
gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the
/queue/joinendpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.Release Notes
gradio-app/gradio (gradio)
v4.19.2Compare Source
Features
ddd4d3e- Enable Ruff S101. Thanks @abidlabs!b7a97f2- Updatehttpxtohttpx>=0.24.1inrequirements.txt. Thanks @abidlabs!16fbe9c- Prevent components from working with non-uploaded files. Thanks @aliabid94!84802ee- Tighten CORS rules. Thanks @abidlabs!Fixes
98a2719- Fix z-index layer of orange generating border. Thanks @daviirodrig!9c36572- Quick fix: File height overflow. Thanks @dawoodkhan82!ddd4d3e- ensure Dataframe headers are aligned with content when scrolling. Thanks @abidlabs!ba3ec13- Tab select fix. Thanks @aliabid94!b186767- FixGallerypreview overlay and backdrop. Thanks @MMP0!33f68cb- Fix Canvas3D/Canvas3DGS async imports. Thanks @whitphx!v4.19.1Compare Source
Features
ba747ad- Make fix in #7444 (Block /file= filepaths that could expose credentials on Windows) more general. Thanks @abidlabs!c88290d- WIP: Optimize /file route. Thanks @freddyaboulton!e329f1f- Prevent timing attacks to guess Gradio passwords. Thanks @abidlabs!3e4e680- Fixes to the.key_up()method to make it usable for a dynamic dropdown autocomplete. Thanks @abidlabs!Fixes
4faf8a7- Block/file=filepaths that could expose credentials on Windows. Thanks @abidlabs!f52cab6- Dispatch change event for file explorer. Thanks @aliabid94!fb1f6be- Run pre/post processing in threadpool. Thanks @freddyaboulton!6b8a7e5- Ensuregr.Dropdowncan have an empty initial value. Thanks @hannahblair!f191786- Improve responsiveness ofgr.Audio()controls. Thanks @hannahblair!Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.